[LLVMbugs] [Bug 15947] New: Miscompiled code and corrupted stack frame

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=15947

            Bug ID: 15947
           Summary: Miscompiled code and corrupted stack frame
           Product: clang
           Version: unspecified
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: -New Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: llvmbugs.20.adept at 0sg.net
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

Apple LLVM version 4.2 (clang-425.0.27) (based on LLVM 3.2svn)
Target: x86_64-apple-darwin12.3.0
Thread model: posix

Hallo LLVM team,
I have encountered a miscompilation which corrupts the stack frame. In can be
reduced to this code:


struct Vector4
{
    // When the following lines are uncommented, the codegen is correct.
    // Vector4() = default;
    // Vector4( const Vector4 &other ) : x( other.x ), y( other.y ), z( other.z
), w( other.w ) {};
    float x, y, z, w;
};

inline
Vector4 operator *( const Vector4 &lhs, float rhs )
{
    Vector4 result;
    // Should be legal. Since a Vector4 contains floats, a float * can alias as
a Vector4 *.
    for( unsigned i = 0; i < 4; ++i )
        ((float *)&result)[i] = ((const float *)&lhs)[i] * rhs;
    return result;
}

void testmain( float x )
{
    extern Vector4 X;
    extern Vector4 A;
    X = A * x;
}


The disassembly shows that in the for-loop in the multiplication operator
destroys the value of %rbp that was saved onto the stack frame. Whats more, in
basic block 2 only half of the members are returned in the result.


# Assembly output for codegen.cc
# Generated at 2:32:41 vorm. on Freitag, Mai 10, 2013
# Using Release configuration, x86_64 architecture for test target of libmbl
project

    .section    __TEXT,__text,regular,pure_instructions
    .private_extern    __Z8testmainf
    .globl    __Z8testmainf
__Z8testmainf:                          ## @_Z8testmainf
    .cfi_startproc
## BB#0:
    pushq    %rbp
Ltmp2:
    .cfi_def_cfa_offset 16
Ltmp3:
    .cfi_offset %rbp, -16
    movq    %rsp, %rbp
Ltmp4:
    .cfi_def_cfa_register %rbp
    xorl    %eax, %eax
    movq    _A at GOTPCREL(%rip), %rcx
LBB0_1:                                 ## =>This Inner Loop Header: Depth=1
    movss    (%rcx,%rax,4), %xmm1
    mulss    %xmm0, %xmm1
    movss    %xmm1, -8(%rbp,%rax,4)
    incq    %rax
    cmpl    $4, %eax
    jne    LBB0_1
## BB#2:                                ## %_ZmlRK7Vector4f.exit
    movq    -8(%rbp), %rax
    movq    _X at GOTPCREL(%rip), %rcx
    movq    %rax, (%rcx)
    movq    $0, 8(%rcx)
    popq    %rbp
    ret
    .cfi_endproc


The following is the disassembly when the two constructors are uncommented. The
function then works as expected.


# Assembly output for codegen.cc
# Generated at 2:37:34 vorm. on Freitag, Mai 10, 2013
# Using Release configuration, x86_64 architecture for test target of libmbl
project

    .section    __TEXT,__text,regular,pure_instructions
    .private_extern    __Z8testmainf
    .globl    __Z8testmainf
__Z8testmainf:                          ## @_Z8testmainf
    .cfi_startproc
## BB#0:
    pushq    %rbp
Ltmp2:
    .cfi_def_cfa_offset 16
Ltmp3:
    .cfi_offset %rbp, -16
    movq    %rsp, %rbp
Ltmp4:
    .cfi_def_cfa_register %rbp
    xorl    %eax, %eax
    movq    _A at GOTPCREL(%rip), %rcx
LBB0_1:                                 ## =>This Inner Loop Header: Depth=1
    movss    (%rcx,%rax,4), %xmm1
    mulss    %xmm0, %xmm1
    movss    %xmm1, -16(%rbp,%rax,4)
    incq    %rax
    cmpl    $4, %eax
    jne    LBB0_1
## BB#2:                                ## %_ZmlRK7Vector4f.exit
    movq    -16(%rbp), %rax
    movq    -8(%rbp), %rcx
    movq    _X at GOTPCREL(%rip), %rdx
    movq    %rcx, 8(%rdx)
    movq    %rax, (%rdx)
    popq    %rbp
    ret
    .cfi_endproc

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130510/1286a0b7/attachment.html>